Hive

final class ntoseye.Hive

Subclass of BaseRecord.

property address: int

property base_block: int

_HHIVE.BaseBlock, and the end of the file’s name it records.

property base_block_name: str | None

property file: str | None

The file it was loaded from (FileUserName, else FileFullPath).

property flags: int

_HHIVE.HiveFlags.

property flat: bool

The hive is one block of memory (a hive the boot loader loaded, read before its cell map exists).

property master: bool

The master hive (nt!CmpMasterHive), whose root is \REGISTRY.

property mount: Diagnostic[str | None]

Where it is mounted (HiveRootPath), \REGISTRY for the master hive; None for one not mounted. Unavailable before Vista, whose hives do not record it, and where the path does not read.

property root_cell: Diagnostic[int]

_HBASE_BLOCK.RootCell, the cell of its root key.

property stable_length: int

The bytes of its stable storage.

property stable_map: int

The stable storage’s cell map (_HMAP_DIRECTORY).

property version: int

_HHIVE.Version, the format’s minor version.

property volatile_length: int

The bytes of its volatile storage.

property volatile_map: int

The volatile storage’s cell map (_HMAP_DIRECTORY).